Avoiding bias in cards cryptography 
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1 Introduction 

Public key cryptography bases its security on mathematical problems that are difficult to 
solve such as the discrete logarithm problem or factoring the product of two large primes. 
Advances in technology and new discoveries in mathematics make it more feasible to solve 
these problems, i.e. it becomes more feasible to break the encryption^ One solution is to 
use larger prime numbers to raise the bar a little higher, but this also translates to more 
computation needed to actually use the encryption, making it more inconvenient for the user. 
In addition, new mathematical discoveries may suddenly provide an easy way to solve these 
problems and therefore render the complete algorithm useless for encryption. Instead, one 
might look at cryptographic protocols in which discovering the secret is not only too complex 
given the current state of technology but actually impossible. That is, the cryptographic 
protocol must be developed with a computationally unlimited attacker in mind. One such 
approach involves the use of a random deck of cards. The general scenario is as follows: 
Two agents, Alice and Bob, draw a and b cards from a deck of a + b + c cards, and Cathy, 
the attacker (a.k.a. Eve, the eavesdropper), receives the remaining c cards. Alice wishes to 
communicate her cards to Bob by making a public announcement without informing Cathy of 
any of her card s . The generalised problem has parameters (a, b, c) and was inspired by what 
van Ditmarsch ( 20031 ) has called the Russian Cards problem, which constitutes the (3,3,1) 
instance and was presented at the Moscow Mathemati cal Olympiad in 

2000JL There are also 

relations to bit-exc hange protoco ls using card deals ( Fischer and Wright . 19961 ) and 'cards 
cryptography' as in LStiglid (|200ll ). 

Previous work on the Russian Card s problem involved us i ng ep istemic logic to describe 
its properties and to find its solutions ( van Ditmarsch . 20031 . 2005 ). including the analysis 
of protocols wherein Alice communicates her hand of cards to Bob with more than one 
announcement, depending on Bob's response to her initial announcement. In Ivan Ditmarsch 



(|2003h it is shown that however Alice structures her announcement, it always corresponds to 
an announcement of the form "I hold one of the following hands: . . . " . The generalised version 
has also been investigated by Albert. Aldred. Atkinson, van Ditmarsch. and Handley ( 20051 ): 
they devise combinatorial analogues CAl, CA2 and CA3 of the epistemic requirements for 
Alice to communicate her hand of cards safely to Bob, and they have found various methods 
to construct 'good announcements' that satisfy these combinatorial axioms. 



Agrawal el all l|2004) show that to determine whether a number is prime can be done in polynomial time. 



This is not necessarily related to the complexity of determining whe ther a numbe r is a product of primes. 
At the time Hans van Ditmarsch did not know that it occurs in IWallisI (|1988| ). 
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For the (3, 3, 1) instance, suppose Alice announces that she holds one of {012, 034, 056, 135, 
246} (by 012 we mean the set {0, 1, 2}, etc.). Her announcements are supposed to be truthful, 
and her actual hand must therefore be among those five. No matter which of those Alice holds, 
and no matter what Bob holds, he can infer Alice's cards. For example, if Bob held 126, then 
he could eliminate 012, 056, 135 and 246, leaving only 034, that must therefore be Alice's 
actual hand. And no matter what Cathy holds, she cannot infer any card of Alice or Bob. Say 
Cathy held card 5, then she could eliminate 056 and 135, leaving her with 012, 034 and 246 
for Alice's hand and (by considering the remaining cards) 346, 126 and 013 for Bob's hand. 
One can establish that the combinatorial axioms CAl, CA2 and CA3 are indeed satisfied, 
and that this is therefore a good announcement. 

Also for the (3, 3, 1) instance, and supposing Alice holds 034, she could announce that she 
holds one of {012,034,056,135,146,236,245}. This is a seven-hand announcement. We can 
similarly establish that this is a good ann ouncement H 

Some of the constructions proposed by lAlbert et all , while not giving away enough infor- 
mation for Cathy to determine any card held by Alice or Bob, will result in situations where 
Cathy can make an educated guess based on the relative frequency of the cards. For example, 
consider again the announcement for (3, 3, 1) given as {012, 034, 056, 135, 246}. Let us assume 
that Cathy holds card 3. Then she can exclude all but 012, 056 and 246 from the announce- 
ment. Among these, card 2 occurs more often than card 1. In the absence of information on 
how Alice's announcement has been produced by a protocol, and discounting that Alice (of 
course) will anticipate such a line of argument, it is reasonable for Cathy to assume that all 
of Alice's holdings are equally likely. But in that case Alice is more likely to hold card 2 than 
card 1. In other words: even though the announcement is unbiased with respect to holdings, 
the announcement may be biased with respect to card occurrences, or otherwise biased with 
respect to patterns in the announcement, and this information may be valued by the eaves- 
dropper (attacker) Cathy. The other announcement, {012,034,056,135,146,236,245}, does 
not contain card occurrence bias. 

From the perspective of cryptography, there appear to be two distinct ways to overcome 
such bias: either use protocols that produce announcements that are unbiased for card occur- 
rence (or more complex patterns), or use protocols that (may) produce biased announcements 
but ensure that there is no relation between patterns in the announcement, such as card oc- 
currence, and the actual holding. We focus on the first, in Section [21 using design theory. We 
devise an additional requirement for the announcement in order to eliminate the possibility 
of making educated guesses. To that effect we propose an additional combinatorial axiom 
CA4. We give a method to design announcements that meet this requirement, unbiased an- 
nouncements therefore, and we prove some relevant results. Those are our main contributions. 
Additionally, in Section [3l we present unbiased protocols for the (3, 3, 1) case, counteracting 
single card occurrence bias in announcements. 



2 Unbiased announcements 



2.1 Combinatorial axiom CA4 

We will use terminology as in lAlbert et all ifcoOfil ). Cards are commonly referred to as points, 
are all distinct, and are labeled with consecutive natural numbers. The set of all cards (or 



This exact solution is found on the very first page of lWaUid (|l988h . 
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deck of cards) is denoted by Q. An i-set is a set of i cards. A possible holding (or hand) of 
Alice is called a line (in other words, a line is an a-set). Thus, an announcement C by Alice 
consists of one or more lines. We write X, Y, Z for i-sets, x, y, z for points in such sets, and in 
particular also L for a-sets (lines). Alice, Bob, and Cathy hold, respectively, a, 6, and c cards. 
These are the parameters of the card deal, for which we write (a,b,c). 'Elimination' refers 
to Cathy or Bob eliminating those lines from the announcement that are impossible holdings 
for Alice becaus e they contain one or more of their own cards. 



Albert et al.\ proposed three axioms CA1, CA2, and CA3, that correspond to the informal 
requirements given in the problem description for Alice to inform Bob of her cards. An 
announcement satisfying those axioms is called a good announcement. A good announcement 
guarantees that it is common knowledge among Alice, Bob, and Cathy that Bob knows Alice's 
holding. The axioms are as follows (CA stands for 'Combinatorial Axiom'). 

CA1 For every 6-set X there is at most one line in C that avoids X. 

CA2 For every c-set X the lines in C avoiding X have empty intersection. 

CA3 For every c-set X the lines in C avoiding X have union consisting of all cards except 
those of X. 

Combinatorial Axiom 1 states that, given the announcement, Bob must be able to infer 
what Alice is holding. In order for Bob to figure out which line of the announcement is Alice's 
holding, he has to eliminate lines from the announcement based on his knowledge of his own 
cards. For example, because cards are distinct, if Bob holds card 4, then he can eliminate 
all lines that contain card 4 since those cannot be a possible holding of Alice. Similarly, 
Bob can eliminate any other line that contains a card that he himself holds. A line in the 
announcement that contains none of the cards held by Bob is said to avoid Bob's hand (here 
denoted by 6-set X). If there are two or more such lines in the announcement, then Bob is 
left with more than one possibility for Alice's hand and cannot state with certainty which is 
the correct one. Therefore, there should be at most one line in the announcement that avoids 
Bob's hand. (As we are assuming that the announcement is truthful and that Alice's hand is 
among the lines, there is even exactly one line that avoids Bob's hand.) 

Combinatorial Axiom 2 states that, given the announcement, Cathy must not be able to 
infer any card held by Alice. Cathy employs the same process of eliminating lines from the 
announcement as Bob by looking at her own hand (denoted by c-set X). After elimination, 
she examines the remaining lines. If there is one card common to all these lines, then Cathy 
can conclude that Alice holds that card. So, there must be no card common to all remaining 
lines. In other words, all remaining lines taken together must have empty intersection. 

Combinatorial Axiom 3 states that, given the announcement, Cathy must not be able to 
infer any card held by Bob. If it is not satisfied, there is a card that does not occur among 
the lines avoiding Cathy's holding X. This card is therefore not held by Alice, nor is it held 
by Cathy. It must therefore be a card held by Bob. 

For parameters (3,3,1), the announcements {012,034,056,135,246} and {012,034,056, 
135, 146,236,245} both satisfy CA1, CA2, and CA3, as can be easily checked. We propose 
to distinguish between these announcements by means of another, new, combinatorial axiom. 
This is CA4. It expresses absence of card occurrence bias. We also propose yet another 
axiom, CA5, that will then be shown equivalent to CA4. 
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CA4 For every c-set X there is a number nx such that for every point x £ X there are nx 
lines in C avoiding X that contain x. 



CA5 For every c-set X there is a number mx such that for every point y £ X there are mx 
6-sets Y avoiding X that contain y and that avoid an L € C also avoiding X. 

Combinatorial Axiom 4 states that, given Alice's announcement and Cathy's hand of cards, no 
card occurs more often than another one in the lines Cathy considers possible. Combinatorial 
Axiom 5 states that, given Alice's announcement and Cathy's hand of cards, no card occurs 
more often than another one in the 6-sets Cathy considers possible for Bob. 

The new combinatorial axioms become more readable if we introduce additional formali- 
sation. Given a collection Z of i-sets ZC(! (lines, 6-sets, c-sets, ...), the subset of Z with all 
points contained in X C $7 is denoted Z(X), i.e. 

Z{X) = {Z € Z | Z C X}. 

On the other hand, the set of i-sets in Z containing (all) points in X is denoted Z[X], i.e. 

Z[X] = {Z € Z | X C Z}. 

For Z({x}), write Z(x), and for i?[{x}], write Z[x]; for Z{X U {x}) we write Z{X + x), for 
Z({x,y}) we write Z(xy), etc. The complement of X in f2 is X. We combine the notations, 
e.g. we write £(X)[x] for the set of lines in C avoiding X and containing x. Finally, somewhat 
arbitrarily, b(C(X)) is the set of 6-sets Y avoiding X and an L € C also avoiding X, i.e. 

b(C(X)) = {Y | Y = n - X - L, L G C, L n X = 0}. 

We now can rephrase the combinatorial axioms as 

Definition 1 (Combinatorial Axioms). We distinguish five axioms. 

CA1 For every b-set X: \C{X)\ < 1. 

CA2 For every c-set X: [}C{X) = 0. 

CA3 For every c-set X: \JC(X) = X. 

CA4 For every c-set X there is a number nx such that for every x £ X : \C(X)[x]\ = nx- 

CA5 For every c-set X there is a number mx such that for every x ^ X: \b(C{X))[x} \ = mx- 

Announcement {012,034,056,135,246} does not satisfy CA4. Take X = {5}. The lines 
not containing 5 (i.e., avoiding {5}) are 012, 034 and 246. Two of those contain 2 but only 
one line contains 1. Therefore, no number 715 (i.e., nr^x) exists in this case. On the other 
hand, announcement {012, 034, 056, 135, 146, 236, 245} satisfies CA4, with n y = 2 for all points 
y = 0, . . . , 6. E.g., {135, 146, 236, 245} avoid 0; point 1 occurs twice in those, namely in 135 
and 146; and so on for other points. Announcement {012, 034, 056, 135, 246} does not satisfy 
CA5. Take X = {5}. The 6-sets not containing 5 and avoiding one of 012,034 and 246 are: 
346, 126 and 013. Two of those contain a 1 but only one contains a 2. Again, the seven-line 
announcement satisfies CA5. 



Ma ny other , and more generic, examples can be found using design theory (see IWallis 



(fl988l l: lHughe l flA ). The mathematical theory of block designs deals with collections of 
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special subsets, called blocks (or lines), of a given set. It provides a convenient framework for 
studying the relation between the proposed combinatorial axioms CA4 and CA5. A t-design 
with parameters (v, k, A) has the property that any combination of t distinct elements of a 
set of v = | J) | points occurs in the same number A of fe-blocks (or fc-lines). The number 
A is referred to as the covalency of the design. Thus, in 2-designs, also known as balanced 
incomplete block designs, any pair of distinct cards occurs in the same number of lines. This is 
relevant for our investigation, because it entails that in the subset of lines containing any given 
card (such as a singleton c-set), any other card occurs in the same number of lines. Similarly, 
in 3-designs any 3-tuple of distinct cards occurs in the same number of lines. This can be 
further generalised to 4-designs, 5-designs, etc., but such designs are far less common and few 
general constructions are available that may help us here. Every i-design is also a 1-design, 
2-design, . . . , (t— l)-design. The seven-hand announcement {012, 034, 056, 135, 146, 236, 245} 
is a 2-design, with block size 3 and covalency 1. CA4 can be formulated as 

For every c-set X, C(X) is a 1-design with covalency nx- 

We can construct designs satisfying CA4 using the various methods known for constructing 
designs, such as f rom p r ojecti ve planes and binary desi gns. Incidental results are reported in 
Yated (|l936h and [Bose (1939). For details, we refer to iRoehlingJ (|2005l ). Here, we only show 



how binary designs can be used to construct announcements satisfying CA4. 



Binary designs Binary designs give solutions for a = 2 n ~ , b = a — 1, and c = 1, for n > 3. 
Here, n is the number of bits used in the construction. These designs are special because 
the same n may be associated with more than one instance of the (a, b, c) parameters. For 
example, (8, 7, 1) (satisfying the above for n = 4) and (8, 6, 2) have the same solution given by 
a binary design with n = 4. In Theorem later, we prove that binary designs are 3-designsO 
This is sufficient to guarantee that CA4 is satisfied when c = 1, using another result, Theorem 

El 

Binary designs are constructed as follows. Choose a number of bits n > 3. For all 2 n — 1 
n-bit vectors (2/1,2/2, Un) (except all zeros) solve the equation X\y\ + X2Z/2 + ••• + x n y n = 0, 
where X{ = 0, 1. There are 2 n solutions to each equation, each x\X2—x n representing a point 
in binary. The points gained from an equation together constitute a line. This produces 2 n — 1 
lines (one per equation). For each line, compute the complement by taking all binary points 
that are not present in the line; these complements are also taken as lines. Now we have a 
total of 2(2 n — 1) lines which constitute the announcement. To get the final announcement 
using our format, replace every point in binary with its decimal representation. 

For an example, we construct a binary design with n = 30 Each line consists of 2 n ~ 1 = 4 
points. The 2™ - 1 = 7 non-zero 3-bit vectors are 001,010,011,100,101,110,111. The two 
lines corresponding to the first vector are {000, 010, 100, 110} (in decimal notation {0, 2, 4, 6}, 
i.e. 0246) and {001, 011, 101, 111} (in decimal 1357). Proceed similarly for the remaining 3-bit 
vectors. The resulting announcement consisting of the 2(2 n — 1) = 14 lines is 

{0246, 0145, 0347, 0123, 0257, 0167, 0356, 1357, 2367, 1256, 4567, 1346, 2345, 1247} 

Given parameters (4,3, 1), this announcement C satisfies CA4: for all points y, n y = 4. For 
example, for y = we get £(0) = {4567,2367,2345,1357,1346,1256,1247} and all other 

Specifically, they are 3-(2 n , 2™- 1 , 1) designs. 

5 These are originally known as Steiner quadruples (|Colbourn and Dinit j . fl996l . p. 71). 
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points occur exactly four times in this set: point 1 in the last four lines, point 2 in lines 2, 3, 
6, and 7; etc. 

Apart from CA4, which for parameters (a, b, 1) amounts to checking whether £(x) is a 1- 
design for arbitrary x, one could imagine strengthening the requirements, for example, demand 
that £(x) is a 2-design for all points x as well. We have already seen that the seven-hand 
announcement for (3,3,1) also satisfies this requirement. We will feature a result for this 
stronger requirement in the next section, in Theorem [9j 



2.2 Theoretical results 
Theorem 1. CA4 if and only if CA5. 

Proof. Assume CA4 holds. Let X be any set of c points. For every line L in £(X) there is 
a 6-set n - X -_L in b(£(X)). Therefore, \b(£(X))\ = \£(X)\. Also, for all points y 6 X, 
if y £ Y € £(X) then y Z E b(£(X)) where Z = £1 — Y — X . Point y occurs in nx 
lines in C(X). It therefore does not occur in nx lines in b(£(X)), and it therefore occurs in 
— nx lines in b{C{X)). As this is for arbitrary y, this defines the number mx- The 
argument runs both ways. □ 

In other words, we can forget about CA5 from here on. 

Theorem 2. Let c = 1. (CA4 holds and £ is a 1-design) if and only if C is a 2-design. 

Proof. Assume £ is a 1-design and that CA4 holds, and that c = 1. CA4 says that every £(x) 
is a 1-design. Its size is independent of x, as £ is a 1-design. For arbitrary y £ £(x), 

\£(x)[y}\ + \C[x + y)\ = \C[y]\ (note that \C[x + y}\ = \C[x][y}\). As \C(x)[y]\ and \C(y)\ are 
independent of x and y (by CA4, and because £ is a 1-design, respectively), so is \C[x + y]\. 
Therefore £ is a 2-design. 

Assume £ is a 2-design, i.e. \{L E £ \ x, y £ L}\ = A2 is independent of x and y. We 
want to show that \{L G £(x) \ z € L}\ = n x is independent of z, for any holding x of Cathy. 
Note that when she eliminates lines from £ that contain x, she reduces the number of lines 
containing any y ^ x by A2. Let Ai = \{L 6 £ \ y 6 L}\, which is independent of y because 
£ is also a 1-design. Before elimination Ai lines contained y. After elimination, Ai — A2 lines 
contain y. This is the number of lines n x in £(x) that contain y. Since it is independent of 
y, CA4 holds. □ 

Theorem 3. // CA4 holds then n x = Q| f^ }l ■ 

Proof. Count the total number of cards occurring in £(X) in two ways. Assuming CA4 holds 
there are a + b distinct cards and each of them occurs nx times. There are |£(X)| lines and 
each of them contains o cards. Thus (a + b)nx = a\£(X)\. □ 

Theorem 4. Let c = 1. If CA4 holds then nx is independent of X. 

Proof. Assume c = 1 and CA4 holds. Take two arbitrary distinct X\ = {x\\ and X2 = {^2}- 
Consider £(~x~T). It contains no lines that contain card x\ and n Xl lines that contain card X2- 
It must therefore contain |£(5Tj")| — n Xl lines that contain neither card x\ nor card X2- And 
due to construction of the set, this is the exact number of lines in £ that contain neither card. 
Now consider £(x2). It contains no lines that contain card X2 and n X2 lines that contain card 
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x%. It must therefore contain |£(x2)| — n X2 lines that contain neither card x\ nor card x-i. 
And due to construction of the set, this is the exact number of lines in C that contain neither 
card. Thus, we get the following equation 

\C(xT)\ - n xi = \C(x5) \ - n X2 
a + b a + b 

a a 

a + b \ ( a + b 
1 = rim 1 



a J \ a 

b\ fb s 



n 



a J \ a 

n x -i — *l<r. 



■t'2 



Because x\ and X2 were chosen arbitrarily we conclude that n x is independent of x. □ 

The following follow directly from Theorems [3] and HI 
Corollary 5. If CA4 holds, then \C(x)\ is independent of x. 

Corollary 6. If CA4 holds, \C(x)\ is independent of x if and only if n x is independent of x. 
Theorem 7. Binary designs are 3-designs® 

Proof. By construction binary designs are based on 2™ points and 2(2 n — 1) lines of size 2™~ 1 . 
We now show that any three points pi,P2,P3 occur in exactly 2 n ~ 2 — 1 lines. The lines of the 
design contain points of the form X1X2 ■ ■ ■ x n , that is, a point is represented by an n-vector x. 
For any n-vector y / there is a line {x | y -x = 0} which we call bxo and a line {x | y -x = 1} 
which we call bx\. Let the n- vectors u, v, w be three distinct points in these lines. A line 
containing these comes from a vector y with either y • u = and y • v = and y • w = 0, 
in the case of bx^ (equation i); or y • u = 1 and y • v = 1 and y • w = 1, in the case of bx\ 
(equation ii). We now have two cases: 

1. One of u, v, w is the sum of the other two. Then u, v, w form a subspace U of the vector 
space V of dimension n over the field of 2 elements. The subspace U has dimension 2. 
Note that the bx^s come from U 1 - = {y | y • t = for all t € U} and that dimU + 
dim U 1 - = n. Therefore, the dimension of U 1 - is n — 2 and the number of bxo 's is 2 n ~ 2 — 1 
(excluding y = 0). The number of foci's is because Equation ii cannot hold. 

2. The vectors u, v, w are linearly independent. Then u, v, w form a subspace of dimension 
3 and by the same argument as above the number of bxo 's is 2 n " 3 — 1. The number of 
bxxs is 2 n ~ 3 because we just find one bo for which Equation ii holds and then add all 
the bxo 's. 

In both cases the number of lines that contain the three points is 2 n ~ 2 — 1 in total. Thus, 
binary designs are 3-designs. □ 

Corollary 8. A binary design will satisfy CA4 for c = 1. 



This is an original proof. But we find it likely that this is a known r esult in design th eory. We did not find 
a refe rence to binary designs as an infinite family of 3-designs in either IWallisI l|l98Sl ) or lColbourn and Dinitj 
(1996), except for the already mentioned specific case for n = 3: Steiner quadruples. 
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Proof. Directly from Theorem [2] and Theorem [JJ 



□ 



Theorem 9. C is a 3- design if and only if C(x) is a 2- design for all points x and C is a 

1- design. 

Proof. Let £ be a 3-design. Trivially, it is also a 2-design, and also a 1-design. The last 
satisfies one proof obligation. As C is a 3-design, is independent of y, z, x. As C is a 

2- design, \C[yz] | is independent of y, z; and therefore independent of y, z, x (note that x does 
not occur at all in |£[yz]|). As = |£[yzx]| + |£[yz](x)|, also |£[yz](x)| is independent 
of y,z,x, i.e., for every x, Cix) is a 2-design. 

Assume C(x) is a 2-design for all x, and that C is a 1-design. Similarly to above it 
immediately follows that C is a 3-design. □ 

Corollary 10. Binary designs C satisfy that C(x) is a 2-design for all points x. 

Proof. Directly, from Theorems [7] and [9J □ 



3 Unbiased protocols 

In the previous section we focussed on avoiding bias in an announcement. Such bias resulted 
from the overrepresentation of certain patterns, such as single cards, or pairs of cards, or 
triples, in the announcement or in the remaining lines avoiding a given c-set (eavesdropper 
Cathy's hand of cards). Announcements where arbitrary c-set avoiding lines always are 1- 
designs, or 2-designs, or 3-designs (respectively), guarantee that such bias is absent. The 
suggested link between overrepresentation of patterns (such as individual card occurrence) 
in an announcement and the probability of that pattern occurring in the actual holding 
is, of course, that each line in an announcement is equally likely to be the actual holding. 
Given an underlying protocol to produce such an announcement, this is achieved when each 
announcement resulting from the protocol's execution is equally likely to be produced. In the 
absence of information to the contrary, that may be a reasonable assumption. 

But another way to avoid bias in cryptographic communication is to apply a protocol 
that takes such overrepresentation of patterns in announcements into account. By making 
that protocol public, the sender and receiver can then unbias the announcement — but just 
as well they may keep it secret, and in that case have a cutting edge over an unsuspecting 
eavesdropper. In other words, by applying protocols that make some lines in an announcement 
more likely to be the actual holding than others, the sender can also remove bias. In this 
section we investigate that matter. Our results are less general than those in the previous 
section: we present two different 'unbiasing' protocols for parameters (3,3,1). To investigate 
unbiased announcements, we have over 100 years of design theory to comfortably fall back 
on. But the investigation of unbiased protocols to produce card deal announcements has not 
been investigated in a combinatorial setting, as far as we know. 



Given parameters (3, 3, 1), consider again the five-hand announcement {012, 034, 05 6, 135, 246}. 



Ther e are 60 different five- line announcements containing an arbitrary actual hand (jvan Ditmarsch 



20031 . p.56)Il| In a five-line announcement exactly one point will occur thrice. Suppose 012 



is the actual hand. Of the 60 announcements containing 012, 36 contain an actual card 0, 1, 



7 One of the seven points has to occur thrice in the announcement. In case this is one of the three actual 
cards, one of the three lines containing it will be the actual hand, the four remaining points are distributed 
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or 2 thrice; the remaining 24 therefore contain another card three times. Therefore, a point 
occurring thrice in this five-line announcement is more likely to be an actual card. A protocol 
randomly selecting an announcement containing the actual hand therefore propagates this 
bias, and could rightfully be called a biased protocol. We now adjust ('debias') the protocol 
as follows ('choose' always means 'randomly choose'): 

Fact 11 (Unbiased five-hand announcement). Given are parameters (3, 3, 1). Given an actual 
hand, choose one among the 36 five-hand announcements containing an actual card thrice, 
and choose one among the 24 not containing an actual card thrice. Now choose between 
those two. Given this protocol, there is no relation between the triple point occurrence in the 
announcement and the actual cards. 

Given that one point occurs thrice in a five line announcement, and given that this is 
supposed to be meaningless information, sender Alice might as well make public which point 
that will always be, before being dealt a hand of cards, and then execute some protocol 
resulting in an announcement containing that actual hand, and the pre-announced point 
thrice, whether it is in the actual hand or not§ Unfortunately, if we then choose among all 
such lines, the exact same bias as before again results: 

Given an arbitrary point and an arbitrary line (actual hand), the probability that that 
point avoids that line is | ■ | ■ | = |, so that the probability that the point is in the line, is 
j. There are twelve announcements where the pre-announced point is an actual card, and six 
where this is not the caseM^I As 12 • | = and 6 • | = our bias is again as before: the 
odds are 3 to 2 that a point occurring in an announcement is an actual card. But again, we 
can adjust the protocol, a bit differently now: 



over the other two of the three. Given an assignment of any of those four, we can choose one of the remaining 
three to match it. That determines the third of those lines too. Suppose that i is the chosen actual card, 
j, k the other actual cards, and that the other two lines containing it are ilm and ino. Now consider the two 
lines not containing i. One will contain j, the other k. For the line containing j we can choose one (out of 
two) I, m and one (out of two) n, o. That determines the fifth hand too. Altogether: 3 ■ 3 ■ 2 ■ 2 = 36. Else, 
in case the triple point occurrence is not an actual card, but one of the four other points; say /. This fixes 
the lines not containing that point: one of those is now the actual hand, say ijk again, and the other contains 
the remaining three points, m, n, o. Consider the three lines containing I. Points (actual cards) i, j, k must be 
in three different lines containing I. For any of those, we can now choose between 3 of the remaining points 
m, n, o, and for another of those, between two of the points still remaining after that choice. Altogether: 
4 • 3 • 2 = 24. 

8 Suggested by Ron van der Meyden 

9 In the first case, as before, the four remaining points are distributed over the other two of the three: 
3 • 2 • 2 = 12. Else, also as before, the three actual cards must be in the three different lines containing the 
preselected point, and for any of those, our options are: 3-2 = 6. 

10 Let be the publicly known thrice occurring point. In the first case, let 012 be the arbitrary line containing 

0. The twelve announcements are: 

012 034 056 135 246 012 034 056 136 245 

012 034 056 145 236 012 034 056 146 235 

012 035 046 134 256 012 035 046 136 245 

012 035 046 145 236 012 035 046 156 234 

012 036 045 134 256 012 036 045 135 246 

012 036 045 146 235 012 036 045 156 234 
On the other hand, let 135 be the arbitrary line not containing 0. Note that this fixes the other line not 
containing 0. The 6 announcements are: 

012 034 056 135 246 012 036 045 135 246 

014 023 056 135 246 014 025 036 135 246 

016 023 045 135 246 016 025 034 135 246 
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Fact 12 (Unbiased five-hand announcement with special point). Given are parameters (3, 3, 1). 
Choose one among the twelve possible announcements if the selected thrice occurring point is 
an actual card, and choose one among the six announcements that are possible if this is not 
the case. Choose between those two with probability | for the first and | for the second. 

We close with an additional observation on the status of such protocols. If they are public, 
the combination of the protocol and a resulting announcement makes that announcement 
unbiased for an eavesdropper with regard to single point occurrence. If they are not public, 
but, for example, only known between sender and receiver, the situation becomes much more 
complex. For example, in the absence of information to the contrary, the eavesdropper may 
incorrectly assume that each line in an announcement equally likely, and from that (correctly) 
infer that a thrice occurring point is therefore more likely to be an actual card. But this 
conclusion is then false. Also, if the sender assumes that the eavesdropper follows that line 
of argument, it would even make sense not to apply an unbiased protocol, but one that is 
even biased the other way, namely towards triple occurrence of points that are not actual 
points. Then again, the eavesdropper may anticipate such behaviour of the sender, etc. 
In other words, the optimal strategies for sender and eavesdropper under conditions where 
announcements are always truthful but knowledge of applied protocols is incomplete, are 
unclear. 

On the other hand, incomplete knowledge of a protocol is an unreasonable assumption 
in our current setting: given the 'worst case' assumption where eavesdroppers intercept the 
entire communication, in other words, where it is a public communication, we might as well 
assume the 'worst case' concerning protocol knowledge: the protocol is public. 

4 Conclusions 

We outlined the need for stricter requirements for cryptographic protocols inspired by the 
Russian cards problem. A new requirement CA4 has been proposed. This is shown to be 
equivalent to an alternative requirement CA5. All announcements found to satisfy CA4 are 
2-designs. We have also shown that all binary designs are 3-designs. Instead of avoiding 
bias in announcements produced by such protocols, one may as well apply unbiased protocols 
such that patterns in announcements become meaningless. We gave two examples of such 
protocols for card deal parameters (3, 3, 1). 
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